NAS Files Locked by Ransomware? The Recovery Walkthrough (L0CK3D, .deadbolt, Qlocker)

Your files just got a .L0CK3D, .deadbolt or similar extension, and there's a ransom note in every folder. The next 30 minutes decide how much you get back. Work this list top to bottom — the order matters.

Step 0 — Do NOT do these things

• Don't pay. No agency or vendor recommends it; payment funds the next wave and doesn't guarantee anything.
• Don't reboot, don't "clean up", don't reinstall DSM yet. The open-source c3rb3r-rescue project demonstrated that per-file encryption keys can still be sitting in the malware process's memory — it recovered a 49 GB GitLab backup in full. Rebooting wipes that chance.
• Don't initialize or reset the NAS. On Asustor's own DeadBolt guidance: initializing erases your data.

Step 1 — Contain (2 minutes)

• Unplug the network cable (keep power ON — memory is evidence and possibly your keys).
• If encryption is visibly still progressing (files changing minute by minute), you face a trade-off: powering off stops the damage but destroys memory-resident keys. If a snapshot/backup already exists off-NAS, just shut down; if you have nothing else, capture memory first if you can (see Step 3).

Step 2 — Inventory what you actually have (10 minutes)

Recovery odds, best to worst:

1. Off-NAS/offline backup — an external USB drive, another machine, or cloud sync with versioning. This is the only guaranteed win. This is why 3-2-1 backup exists.
2. Snapshots on the NAS — Synology Snapshot Replication (Btrfs), QNAP snapshots/ZFS, TerraMaster TOS snapshots. Several C3RB3R victims restored whole shares from snapshots taken minutes before encryption. Check the Snapshot app from another admin account if the main UI is trashed. Ransomware can also delete snapshots if it got root — but often doesn't get to all of them.
3. Cloud sync with file versioning — OneDrive/Google Drive keep old versions; encrypted files upload as new versions and the pre-encryption version is still on the cloud side. One Chinese tech publication hit by NAS ransomware recovered this way.
4. Memory-resident keys — c3rb3r-rescue style forensics (C3RB3R-specific, per-sample, advanced).
5. Paying — not on this list. See Step 0.

Step 3 — The Synology-specific traps (C3RB3R victims hit these)

• Encryption Key Vault lockout: if your volume was encrypted and DSM got reinstalled, the vault may reject the old password. Try the recovery key (exported when you set the vault up) before anything else. If both fail, contact Synology support before more reinstall attempts.
• "DSM restored, please reinstall" screen: that's the malware encrypting the system partition. Reinstalling DSM is safe for volume data — but do it only AFTER you've confirmed you have no memory-forensics option and ideally with the disks' data intact (choose "keep files" migration install if offered).
• Hidden admin trap: after recovery, assume all credentials are burned. Rotate every password, regenerate API keys, re-key SSH.

Step 4 — Rebuild clean (don't reinfect)

1. Update DSM/QTS/ADM/TOS/UGOS to the latest build on a clean install before restoring anything.
2. Restore data from your backup/snapshot to the updated system.
3. Audit exposure before reconnecting: close port forwards, disable default admin, 2FA on, snapshots on. Run the hardening checklist top to bottom — getting hit twice in one quarter is a documented pattern.
4. Scan restored files (the malware skipped executables by design, but don't trust that).

Vendor-specific notes

Vendor	Where snapshots live	Support path
Synology	Snapshot Replication (Btrfs volumes)	support.synology.com — mention C3RB3R
QNAP	Storage & Snapshots app; Hybrid Backup Sync	Malware Remover + support ticket
Asustor	Snapshots (Btrfs models)	Asustor support form (DeadBolt-era process)
TerraMaster	TOS Snapshot	TerraMaster support

For the attack itself — who, how, which CVE — see the C3RB3R incident page or the full NAS ransomware history.

Can .L0CK3D files be decrypted for free?

No universal free decryptor for C3RB3R is confirmed as of end-October 2026. Realistic recovery paths: snapshots, off-NAS backups, cloud-sync version history, or memory forensics with the open-source c3rb3r-rescue method (advanced, per-case). Watch Synology's advisory page — free decryptors sometimes appear after campaigns wind down.

Should I pay the ransom?

No. Synology, KISA, Macau's judicial police and every CERT that has commented advise against paying. It funds future attacks, decryption isn't guaranteed, and victims of NAS ransomware who had 3-2-1 backups recovered without paying.

Ransomware encrypted DSM and it won't boot — is reinstalling safe?

Reinstalling DSM does not erase volume data, and several victims had to. But order matters: pull the network cable first, don't initialize the disks, and if you had an encrypted volume, find the Encryption Key Vault recovery key BEFORE reinstalling — one victim locked himself out by reinstalling first.

Will antivirus/anti-ransomware tools recover my files?

No. Malware removers (like QNAP's) quarantine the note/malware but don't decrypt files. Recovery comes from backups, snapshots, versions, or forensic key recovery — not from cleaning tools.

The police/CERT asked me to report it. Should I bother?

Yes — KISA in Korea and Macau's PJ actively collected reports during this campaign, and reports sometimes unlock collective action. But don't wait for them to recover your files; work the recovery ladder in parallel.